Re: [PATCH v7 14/14] ima: Setup securityfs for IMA namespace

[Stefan Berger <stefanb@linux.ibm.com>]

On 12/16/21 08:51, Christian Brauner wrote:
>
>> +int ima_fs_ns_init(struct user_namespace *user_ns, struct dentry *root)
>>   {
>>   	struct ima_namespace *ns = user_ns->ima_ns;
>> -	struct dentry *ima_dir;
>> +	struct dentry *int_dir;
>> +	struct dentry *ima_dir = NULL;
>>   	struct dentry *ima_symlink = NULL;
>>   	struct dentry *binary_runtime_measurements = NULL;
>>   	struct dentry *ascii_runtime_measurements = NULL;
>>   	struct dentry *runtime_measurements_count = NULL;
>>   	struct dentry *violations = NULL;
>>   
>> -	ima_dir = securityfs_create_dir("ima", integrity_dir);
>> +	/* FIXME: update when evm and integrity are namespaced */
>> +	if (user_ns != &init_user_ns) {
>> +		int_dir =
>> +			securityfs_create_dir("integrity", root);
>> +		if (IS_ERR(int_dir))
>> +			return -1;
> That should probably be return PTR_ERR(int_dir)

That's actually from current usptream ( 
https://elixir.bootlin.com/linux/latest/source/security/integrity/ima/ima_fs.c#L457 
) The question is then whether at the end it should also return 
something else than what it currently returns:

out:
     securityfs_remove(violations);

     [...]

     securityfs_remove(ima_policy);
     return -1;